Ethical Hacking News
Cisco Security Flaws Exposed: A Zero-Day Attack on U.S. Federal Agencies
The US government has issued an emergency directive ordering all federal agencies to patch two critical security flaws in their Cisco firewall devices, citing widespread exploitation of these vulnerabilities by threat actors. The vulnerability CVE-2025-20333 can allow authenticated attackers to remotely gain code execution on vulnerable devices, while CVE-2025-20362 enables remote threat actors to access restricted URL endpoints without authentication. The ArcaneDoor campaign has been responsible for breaching government networks worldwide since November 2023 and has linked these ongoing attacks to the UAT4356 threat group behind the campaign. Organizations must take immediate action to address these security flaws and prevent further exploitation.
CISA has issued an emergency directive ordering U.S. federal agencies to patch two critical security flaws in Cisco firewall devices.The vulnerabilities, CVE-2025-20333 and CVE-2025-20362, have been exploited in zero-day attacks, allowing attackers to gain unauthenticated remote code execution.Agencies must disconnect compromised devices from the network and upgrade or patch those that show no signs of malicious activity by September 26.Cisco has released security updates to address these vulnerabilities, which can allow authenticated attackers to remotely gain code execution on vulnerable devices.The ArcaneDoor campaign has been linked to these vulnerabilities, with attacks observed worldwide since November 2023.Organizations must prioritize their cybersecurity posture, particularly when it comes to patching critical vulnerabilities in widely used software.
The United States Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive ordering all U.S. federal agencies to patch two critical security flaws in their Cisco firewall devices, citing widespread exploitation of these vulnerabilities by threat actors. The directive, titled "Emergency Directive 25-03," requires agencies to address the vulnerabilities CVE-2025-20333 and CVE-2025-20362 in their Adaptive Security Appliance (ASA) and Firewall Threat Defense (FTD) software.
These vulnerabilities have been exploited in zero-day attacks, allowing attackers to gain unauthenticated remote code execution on ASAs and manipulate read-only memory (ROM) to persist through reboot and system upgrades. CISA warns that this activity presents a significant risk to victim networks, highlighting the urgent need for agencies to take action.
The ArcaneDoor campaign, linked to these vulnerabilities, has been responsible for breaching government networks worldwide since November 2023. The attackers have employed advanced evasion techniques, including disabling logging, intercepting CLI commands, and intentionally crashing devices to prevent diagnostic analysis. In some cases, Cisco has observed the threat actors modifying ROMMON to allow for persistence across reboots and software upgrades.
CISA and Cisco have linked these ongoing attacks to the ArcaneDoor campaign, which exploited two other ASA and FTD zero-days (CVE-2024-20353 and CVE-2024-20359) in November 2023. The UAT4356 threat group behind the campaign has tested and developed exploits for these vulnerabilities since at least July 2023.
The attacks have deployed previously unknown Line Dancer in-memory shellcode loader and Line Runner backdoor malware to maintain persistence on compromised Cisco devices. This malicious activity has been observed on 5500-X series devices without secure boot enabled, which are being targeted by the attackers.
In addition to patching these vulnerabilities, CISA is requiring agencies to identify all Cisco ASA and Firepower appliances on their networks, disconnect all compromised devices from the network, and upgrade devices that show no signs of malicious activity. Agencies must also permanently disconnect ASA devices reaching the end-of-support period by September 30 from their networks.
Cisco has released security updates to address these vulnerabilities, noting that CVE-2025-20333 can allow authenticated attackers to remotely gain code execution on vulnerable devices, while CVE-2025-20362 enables remote threat actors to access restricted URL endpoints without authentication. When chained, the two vulnerabilities can enable unauthenticated attackers to gain full control of unpatched devices remotely.
The U.S. cybersecurity agency now requires all FCEB agencies to account for all Cisco ASA and Firepower appliances on their networks, disconnect all compromised devices from the network, and patch those that show no signs of malicious activity by 12 PM EDT on September 26. Agencies must also permanently disconnect ASA devices reaching the end-of-support period by September 30 from their networks.
The UK's National Cyber Security Centre (NCSC) has also issued a warning about these attacks, stating that the attackers are targeting 5500-X series devices without secure boot enabled to deploy LINE VIPER user-mode shellcode loader malware and GRUB bootkit dubbed 'RayInitiator' to implant malware, execute commands, and potentially exfiltrate data from compromised devices.
The ongoing attacks highlight the urgent need for organizations to prioritize their cybersecurity posture, particularly when it comes to patching critical vulnerabilities in widely used software. The use of zero-day exploits by threat actors underscores the importance of staying vigilant and proactive in responding to emerging threats.
In light of these developments, it is essential for federal agencies to take immediate action to address these security flaws and prevent further exploitation. This includes ensuring that all necessary patches are applied, disconnecting compromised devices from the network, and conducting thorough forensic analysis to assess compromise and identify potential vulnerabilities.
The incident also serves as a reminder of the importance of secure boot mechanisms in preventing malware deployment on vulnerable devices. The use of Line Dancer and Line Runner backdoor malware by the attackers highlights the need for organizations to implement robust security controls, including endpoint detection and response (EDR) solutions, to detect and respond to such threats.
Furthermore, the ArcaneDoor campaign demonstrates the ongoing threat landscape in the cybersecurity domain, with new campaigns and vulnerabilities emerging regularly. Organizations must remain vigilant and proactive in responding to these emerging threats, prioritizing patching critical vulnerabilities, and implementing robust security controls to protect against potential attacks.
In conclusion, the recent exploitation of zero-day vulnerabilities in Cisco ASA and FTD software highlights the urgent need for organizations to prioritize their cybersecurity posture. The attack campaign, linked to ArcaneDoor, demonstrates the ongoing threat landscape and the importance of staying vigilant and proactive in responding to emerging threats. Organizations must take immediate action to address these security flaws and prevent further exploitation.
Related Information:
https://www.ethicalhackingnews.com/articles/Cisco-Security-Flaws-Exposed-A-Zero-Day-Attack-on-US-Federal-Agencies-ehn.shtml
https://www.bleepingcomputer.com/news/security/cisa-orders-agencies-to-patch-cisco-flaws-exploited-in-zero-day-attacks/
Published: Thu Sep 25 19:25:22 2025 by llama3.2 3B Q4_K_M
